Ensuring Private Traffic to Amazon S3 with VPC Endpoints

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

A Create a gateway VPC endpoint for the S3 bucket and configure the subnet route table to use it.

Question

A company runs its legacy web application on AWS. The web application server runs on an Amazon EC2 instance in the public subnet of a VPC. The web application server collects images from customers and stores the image files in a locally attached Amazon Elastic Block Store (Amazon EBS) volume. The image files are uploaded every night to an Amazon S3 bucket for backup. A solutions architect discovers that the image files are being uploaded to Amazon S3 through the public endpoint. The solutions architect needs to ensure that traffic to Amazon S3 does not use the public endpoint. Which solution will meet these requirements?
  1. Create a gateway VPC endpoint for the S3 bucket that has the necessary permissions for the VPC. Configure the subnet route table to use the gateway VPC endpoint. Correct Answer
  2. Move the S3 bucket inside the VPC. Configure the subnet route table to access the S3 bucket through private IP addresses.
  3. Create an Amazon S3 access point for the Amazon EC2 instance inside the VPConfigure the web application to upload by using the Amazon S3 access point.
  4. Configure an AWS Direct Connect connection between the VPC that has the Amazon EC2 instance and Amazon S3 to provide a dedicated network path.

Key Takeaways

The question tests knowledge of AWS networking services, specifically distinguishing between Gateway VPC Endpoints (for S3/DynamoDB) and Interface VPC Endpoints (for other services), while avoiding common traps like trying to 'move' global services into a VPC.

This question tests the correct method for accessing Amazon S3 privately from an EC2 instance within a VPC without using the public internet. The correct solution involves using a Gateway VPC Endpoint to route traffic through the AWS internal network.

Common mistake: Many learners incorrectly choose Option C (S3 Access Point) because it sounds secure, but access points are primarily for granular access control and do not inherently force private routing; they still require a VPC endpoint or specific policies to prevent public internet traversal if the instance is in a public subnet without proper routing.

Expert Analysis

Why the Answer Is Correct

Option A is the correct answer because a Gateway VPC Endpoint provides private connectivity between your VPC and supported AWS services like Amazon S3 and DynamoDB. By creating a gateway endpoint and updating the route table, traffic destined for S3 is routed through the AWS internal network rather than the public internet, satisfying the requirement to avoid the public endpoint. This is the standard and most cost-effective way to secure S3 access from within a VPC.

Why the Other Options Are Wrong

Option B is invalid because Amazon S3 is a global service and cannot be 'moved inside' a VPC; buckets exist in regions, not within specific VPCs. Option C is incorrect because while S3 Access Points provide a way to manage access, they do not by themselves ensure that traffic does not traverse the public internet unless combined with a VPC Endpoint policy or specific routing configurations. Option D is overly complex and expensive; Direct Connect is used for connecting on-premises networks to AWS, not for internal VPC-to-S3 communication.

Community Comment Notes

Community feedback largely supports Option A, with users noting that Gateway VPC Endpoints are the standard solution for private S3 access. One user pointed out that S3 is a global service and cannot be moved into a VPC, highlighting why Option B is impossible. Another user clarified that Access Points do not ensure private traffic at all, reinforcing why Option C is a distractor.

Exam Strategy

When asked to securely access AWS services like S3 or DynamoDB from a VPC, always consider Gateway VPC Endpoints first. They are free, easy to configure, and specifically designed for these services to keep traffic within the AWS backbone.

Frequently Asked Questions

Why can't I just move the S3 bucket into the VPC?

Amazon S3 is a global service and cannot reside inside a VPC. You must use VPC endpoints to access it privately.

Is an S3 Access Point enough to stop public internet traffic?

No. An Access Point manages permissions but doesn't change routing. You still need a VPC Endpoint to keep traffic off the public internet.

More SAA-C03 FAQ →

Community Votes

A
67%
C
33%

67% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. JA2018 👍 3 Answered C
    I will choose Option C for the following reasons: Private access: S3 access points allow you to create a private endpoint within your VPC that can be used to access the S3 bucket without going through the public endpoint. Security best practice: Using an S3 access point is considered a secure way to manage access to your S3 buckets from within your VPC. Configuration simplicity: You only need to configure the web application to use the S3 access point, making it a relatively straightforward implementation.
  2. LeonSauveterre 👍 3 Answered A
    A - Gateway VPC Endpoint provides private connectivity between resources in a VPC and AWS services like S3 without requiring an internet gateway, NAT gateway, or public IP address. B - This is just bull. Amazon S3 is a global service that cannot "move" into a VPC. C - This doesn't ensure private traffic between the EC2 instance and S3 at all. You still need VPC Endpoint. D - This may actually work but more expensive and complex compared to option A.
  3. FlyingHawk 👍 1 Answered A
    A gateway VPC endpoint allows private connectivity between your VPC and Amazon S3. It ensures that traffic between the VPC and S3 stays within the AWS network and does not traverse the public internet. B- S3 buckets cannot be "moved inside the VPC." S3 is a regional service and does not reside within a VPC. This option is not valid. C - S3 access points are used to simplify access control for S3 buckets, but they do not provide private connectivity. Traffic to S3 access points still uses the public endpoint unless combined with a gateway VPC endpoint.
  4. aragon_saa 👍 2 Answered A
    Answer is A

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide